CIS Analyzes KrustyLoader’s Use of S3 Buckets to Deliver Sliver
Summary
CIS analyzed KrustyLoader samples hosted in S3, detailing how the loader decrypts and injects a Sliver payload. Nine SLTT environments had DNS queries to associated infrastructure, but CIS could not confirm downloads or infections.
Key points
- KrustyLoader retrieves an encrypted Sliver payload from a second S3 location, injects it into explorer.exe, then attempts to erase itself from disk.
- CIS identified nine U.S. SLTT environments with successful DNS queries to confirmed staging domains; it could not confirm whether files were downloaded or executed.
- Static analysis recovered the loader’s configuration and decryption keys, revealing a second-stage S3 URL and a Sliver command-and-control domain.
- The Sliver implant supports interactive shell access, in-memory tool execution, and SOCKS5 tunneling for lateral movement.
- CIS found nine related samples across seven S3 buckets using a Rust dependency string as a family indicator; several buckets appeared to have previously belonged to legitimate organizations.
- CIS reported one bucket to AWS, which confirmed its removal on July 9, 2026; other identified buckets remained active as of July 2026.
- CIS notes vendor reporting linking KrustyLoader delivery to exploitation of internet-facing products, but says it cannot independently confirm the actor behind this activity.
Article Details
- Attack Vectors
- KrustyLoader was hosted in S3 buckets and retrieved through DNS-resolved cloud-storage domains, making downloads resemble legitimate cloud traffic.
- Open-source reporting cited by CIS indicates delivery through exploitation of internet-facing Ivanti and SAP NetWeaver systems, followed by writing and executing the loader on compromised hosts.
- The article lists reported exploitation of CVE-2023-46805 and CVE-2024-21887 in Ivanti Connect Secure; CVE-2025-4428 in Ivanti Endpoint Manager Mobile; CVE-2025-31324 in SAP NetWeaver; CVE-2024-1709 and CVE-2024-1708 in ConnectWise ScreenConnect; and CVE-2023-42793 in JetBrains TeamCity.
- Defensive Notes
- CIS recommends vigilance among U.S. SLTT organizations and notes that standard web filtering may not flag traffic to familiar cloud-storage infrastructure.
- CIS submitted an abuse report to AWS, which confirmed removal of kleinnretail[.]s3[.]amazonaws[.]com on July 9, 2026.
- CIS recommends MS-ISAC membership and identifies its Malicious Domain Blocking and Reporting (MDBR) service as a proactive web-security measure.
MITRE ATT&CK
T1055 · Process InjectionKrustyLoader injects the decrypted payload into a live explorer.exe process using RtlCreateUserThread.T1070.004 · File DeletionKrustyLoader attempts to delete its own on-disk body after loading the payload.T1105 · Ingress Tool TransferKrustyLoader retrieves an encrypted Sliver payload from a second-stage S3 location.T1190 · Exploit Public-Facing ApplicationOpen-source reporting cited by CIS describes delivery through exploitation of internet-facing systems, including Ivanti and SAP NetWeaver appliances.
CVE
CVE-2023-42793JetBrains TeamCity (CVE-2023-42793).CVE-2023-46805Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887)CVE-2024-1708ConnectWise ScreenConnect (CVE-2024-1709, CVE-2024-1708)CVE-2024-1709ConnectWise ScreenConnect (CVE-2024-1709, CVE-2024-1708)CVE-2024-21887Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887)CVE-2025-31324SAP NetWeaver (CVE-2025-31324)CVE-2025-4428Ivanti Endpoint Manager Mobile (CVE-2025-4428)
Threat Actors
UNC5221GTI tracks the threat cluster associated with KrustyLoader activity; CIS reports vendor attribution links but says it cannot independently confirm the actor behind this campaign.UTA0178Volexity's label for the threat cluster associated with KrustyLoader infrastructure; CIS says it cannot independently confirm the actor behind this campaign.
Malware
Vendors
Amazon Web ServicesInformation Sharing and Analysis Center® (MS-ISAC®) members directing DNS traffic to Amazon Web Services (AWS) Simple Storage Service (S3) buckets hosting KrustyLoader.ConnectWiseConnectWise ScreenConnect (CVE-2024-1709, CVE-2024-1708)Ivantiindicates threat actors have delivered KrustyLoader by exploiting internet-facing systems, including Ivanti and SAP NetWeaver appliances, and used that access to write and execute the loader on the compromisedJetBrainsJetBrains TeamCity (CVE-2023-42793).SAPthreat actors have delivered KrustyLoader by exploiting internet-facing systems, including Ivanti and SAP NetWeaver appliances, and used that access to write and execute the loader on the compromised host for
Products
Amazon Web Services (AWS) Simple Storage Service (S3)Sharing and Analysis Center® (MS-ISAC®) members directing DNS traffic to Amazon Web Services (AWS) Simple Storage Service (S3) buckets hosting KrustyLoader.ConnectWise ScreenConnectConnectWise ScreenConnect (CVE-2024-1709, CVE-2024-1708)Ivanti Connect SecureIvanti Connect Secure (CVE-2023-46805, CVE-2024-21887)Ivanti Endpoint Manager MobileIvanti Endpoint Manager Mobile (CVE-2025-4428)JetBrains TeamCityJetBrains TeamCity (CVE-2023-42793).SAP NetWeaverthreat actors have delivered KrustyLoader by exploiting internet-facing systems, including Ivanti and SAP NetWeaver appliances, and used that access to write and execute the loader on the compromised host forWindows Explorera downloader that retrieves an encrypted Sliver payload from a second S3 location, injects it into Windows Explorer, and erases itself from disk, leaving the cyber threat actors (CTAs) with immediate covert access to